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In the Claims 

1. (Original) A system for providing service level management in a network, wherein a service 
is composed of network components and a state of the service depends on the state of the network 
components, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, each monitoring agent to detect one or more events relative to the 
respective aspect of operation and to generate an alarm as a function of the one or 
more detected events; and 

an alarm correlation agent to receive the one or more alarms from the 
monitoring agents to determine a state of a service and, if necessary, to issue one or more 
instructions to establish a desired state of the service. 

2. (Original) The system of claim 1, wherein the monitoring agents comprise at least one of: 
an infrastructure monitoring agent to monitor operation of the network infrastructure; 

a computer system monitoring agent to monitor operation of at least one computer 
system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to operation 
of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; 

and 

a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

3. (Original) The system of claim 1, wherein the monitoring agents and alarm correlation 
agents comprise reasoning agents. 
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4. (Original) The system of claim 3, wherein the reasoning agents comprise one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

5. (Original) The system of claim 1, comprising: 

an alarm repository to receive the one or more alarms from the monitoring 
agents, wherein the alarm correlation agent reads the alarms in the alarm repository. 

6. (Currently Amended) A system for providing service level management in a network, 
wherein a 

service is composed of network components and a state of the service depends on a state of 
the network components, the system comprising: 

a first monitoring agent to monitor a respective first aspect of operation of the network, 
the first monitoring agent to detect one or more events relative to the first aspect of operation and 
to generate an alarm as a function of the one or more detected events; 

a second monitoring agent to monitor a respective second aspect of operation 
of the network, different from the first aspect, the second monitoring agent to detect one or more 
events relative to the second aspect of operation and to generate an alarm as a function of the one 
or more detected events; [[and]] 

an alarm repository to receive one or more alarms from each of the first and second 
monitoring agents ; and 

an alarm correlation agent to read the one or more alarms in the alarm repository, and to 
determine a state of a service from the read one or more alarms. 



Claim 7 (Cancelled). 
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8. (Currently Amended) The system of claim [[7]] 6, wherein the alarm correlation agent is 
operative to issue one or more instructions to establish a desired state of the service. 

9. (Original) The system of claim 6, wherein the first and second monitoring agents 
comprise one or more of: 

an infrastructure monitoring agent to monitor operation of the network infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; an application 
monitoring agent to monitor operation of at least one application operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the 
above monitoring agents. 

10. (Currently Amended) The system of claim [[7]] 6, wherein the first and second monitoring 
agents and the alarm correlation agent comprise one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

1 1. (Original) A system for providing service level management in a network having at least 
one monitoring agent to monitor at least one aspect of operation and to generate an alarm as a 
function of one or more detected events, wherein a service is composed of network 
components and a state of the service depends on the state of the network components, the 
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system comprising: 

an alarm correlation agent to receive the one or more alarms from the at least one 
monitoring agent to determine a state of a service and, if necessary, to issue one or more 
instructions to establish a desired state of the service. 

12. (Original) The system of claim 1 1 , wherein the alarm correlation agent comprises one or 
more of: 

a rule-based reasoning agent; 
a model-based reasoning agent; 

a state-transition graph based reasoning agent; a code book reasoning agent; and a 
case-based reasoning agent. 

13. (Currently Amended) A method of providing service level management in a network, 
wherein a 

service is composed of network components and a state of the service depends on the state of the 
network components, the method comprising: 

monitoring one or more aspects of operation of the network and detecting one or more 
events relative to of the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function 
of the respective detected one or more events; and 

corr e lating determining a relationship between the one or more alarms and determining a 
state of the service as a function of the relationship between the one or more alarms corr e lat e d 
alarms . 

14. (Original) The method of claim 13, further comprising: 

generating one or more instructions to establish a desired state of the service. 

15. (Original) The method according to claim 1 3, further comprising monitoring at least one 
of: 

operation of the network infrastructure; operation of at least one computer system on the 
network; 
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traffic on the network; 

operation of at least one application operating on the network; and 

operation of a trouble-ticketing process that receives reports of problems by 

users with respect to operation of the network; 

operation of a device on the network; 

response time of a communication on the network; 

an aggregate of any of the above 

16. (Original) The method of claim 13, wherein the generating an alarm comprises applying at 
least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and case-based 
reasoning. 

17. (Original) The method of claim 13, wherein correlating the one or more alarms comprises 
applying at least one of: 

< rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

18. (Currently Amended) A method of providing service level management in a network, 
wherein a service is composed of network components and a state of the service depends on a 
state of the network components, the method comprising: 

monitoring a first aspect of operation of the network and detecting one or more events 
relative to the first aspect of network operation; 
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monitoring a second aspect of operation of the network, different from the first 
aspect, and detecting one or more events relative to the second aspect of network operation; 

generating a first alarm as a function of the detected one or more events relative to the 
first aspect of network operation; 

generating a second alarm as a function of the detected one or more events 
relative to the second aspect of network operation; [[and]] 

sending the first and second alarms to an alarm repository^ 

accessing the first and second alarms from the alarm repository; and determining a state of 
a service as a function of the accessed first and second 

alarms. 

Claim 19 (Cancelled). 

20. (Currently Amended) The method of claim [[19]] 18, comprising: 

generating one or more instructions to establish a desired state of the service, 
wherein the one or more instructions control an operation of the network. 

21 . (Currently Amended) A computer program product 
comprising: 

a computer readable medium; 

computer program instructions on the computer-readable medium, wherein the 
computer program instructions, when executed by a computer, directs the computer to perform a 
method of providing service level management in a network, wherein a service is composed of 
network components and a state of the service depends on a state of the network components, the 
method comprising: 

monitoring one or more aspects of operation of the network and detecting one 
or more events relative to the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function of the respective 
detected one or more events; and 

corr e lating determining an association between the one or more alarms and determining a 
state of a service as a function of the association correlat e d alarms . 
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22. (Currently Amended) A system for providing service level management in a network, wherein 
a service is composed of network components and a state of the service depends on a state of 

the network components, the system comprising: 

means for monitoring one or more aspects of operation of the network and 
detecting one or more events relative to the one or more aspects of network operation; 

means for generating an alarm for a respective aspect of network operation as a function of 
the respective detected one or more events; and 

means for corr e lating associating t he one or more alarms and determining a state of the 

service as a function of th e associated corr e lat e d alarms. 

23. (Currently Amended) A system for providing service level management in a the network, 
wherein a service is composed of network components and a state of the service depends on the 
state of the network components, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, each monitoring agent to detect one or more events relative to the respective aspect 
of operation and generate an alarm as a function of the one or more detected events; and 

each monitoring agent including an alarm correlation agent to receive one or 
more alarms from the other monitoring agents for consideration in the step of generating the 
alarm as a function of the one or more detected events; and 

each monitoring agent including a control agent to issue one or more instructions 
regarding the respective aspect of operation of the network in order to establish a desired state of a 
service. 

24. (Original) The system of claim 23, wherein the monitoring agents comprise at least one 
of: 

an infrastructure monitoring agent to monitor operation of the network infrastructure; 
a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; an application 
monitoring agent to monitor operation of at least one application operating on the network; 
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a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the 
above monitoring agents. 

25. (Original) The system of claim 23, wherein the monitoring agents comprise at least one 
of: 

a rule-based reasoning agent; a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and a case-based reasoning agent. 

26. (Currently Amended) A computer program product 
comprising: 

a computer readable medium; 

computer program instructions on the computer readable medium, wherein the computer 
program instructions, when executed by a computer, direct the computer to perform a method of 
providing service level management in a network, wherein a service is composed of network 
components and a state of the service depends on a state of the network components, the method 
comprising, for each of a plurality of agents: 

monitoring one or more aspects of the respective operation of the network and detecting 
the one or more events relative to the respective one or more aspects of operation; 

generating an alarm for the respective aspect of network operation as a 
function of the respective detected one or more events; and 

communicating with the other agents to access events or alarms in the respective 
operation of the other monitoring agent, and correlating determining an existence of an 
association between t hese events or alarms from other monitoring agents in the alarm generated 
for the respective aspect of network operation. 



